Agent skill

Iso 27001 Isms

by mohitagw15856 in mohitagw15856/pm-claude-skills

Scope an ISO 27001 ISMS and build the Statement of Applicability across Annex A controls.

MITAuto-check passedLegal & Compliance

Install Iso 27001 Isms

skills CLI
$ npx skills add mohitagw15856/pm-claude-skills --skill iso-27001-isms -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mohitagw15856/pm-claude-skills iso-27001-isms --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mohitagw15856/pm-claude-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/iso-27001-isms .claude/skills/iso-27001-isms && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
iso-27001-isms
GitHub stars
1.4k
Token cost
~996 tokens
SKILL.md length
451 words
Files
2 (incl. scripts)
Skills in repo
1,348
Repo updated
First seen
Licence
MIT

At a glance

Scope an ISO 27001 ISMS and build the Statement of Applicability across Annex A controls.

  • Asked to implement ISO 27001
  • SKILL.md covers Required Inputs, Output Format, Programmatic Helper and Quality Checks, plus 3 more sections
  • Runs Python scripts from its folder; calls python3
  • Build a Statement of Applicability (SoA)

What it does

Iso 27001 Isms is an agent skill from mohitagw15856/pm-claude-skills. Scope an ISO 27001 ISMS and build the Statement of Applicability across Annex A controls. Use when asked to implement ISO 27001, scope an ISMS, build a Statement of Applicability (SoA), or prepare for ISO 27001 certification. Produces an ISMS plan — scope & context, risk-treatment approach, an Annex A control applicability table (the SoA), and a prioritised implementation roadmap.

Its SKILL.md is about 1000 tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files, including scripts (for example `scripts/soa_coverage.py`).

It sits in Legal & Compliance, covering SOC 2 and security compliance. The repository describes itself as: 1255 professional Agent Skills for Claude, ChatGPT, Gemini, Cursor & Codex — PRDs, postmortems, leases, medical bills, layoffs, go-bags, new countries. Plain markdown, MIT, in… The licence is MIT.

When your agent uses it

  • Asked to implement ISO 27001
  • Build a Statement of Applicability (SoA)
  • Prepare for ISO 27001 certification

Example prompts

  • “/iso-27001-isms”

Requirements

  • Python 3

What it can do on your machine

Read from SKILL.md and the folder at commit 1cbf1f0. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 1 file in scripts/ (Python), which the agent can run.

    Shell commands in SKILL.md call:

    • python3

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Iso 27001 Isms loads about 996 tokens when it runs. Until then it costs about 100 tokens; SKILL.md has 451 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~100
When it runs · the whole SKILL.md, loaded when a task matches
~996

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mohitagw15856/pm-claude-skills at commit 1cbf1f0, republished under its MIT licence (© mohitagw15856). 451 words, ~996 tokens.

Download SKILL.mdSave it as .claude/skills/iso-27001-isms/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.
name
iso-27001-isms
description
Scope an ISO 27001 ISMS and build the Statement of Applicability across Annex A controls. Use when asked to implement ISO 27001, scope an ISMS, build a Statement of Applicability (SoA), or prepare for ISO 27001 certification. Produces an ISMS plan — scope & context, risk-treatment approach, an Annex A control applicability table (the SoA), and a prioritised implementation roadmap.

ISO 27001 ISMS Skill

ISO 27001 certifies a system (the ISMS), not a checklist — auditors check that you scoped it, assessed risk, and can justify which Annex A controls you applied or excluded (the Statement of Applicability). This skill builds that backbone: scope, risk treatment, and a defensible SoA, so certification is a documented management system rather than a scramble.

Required Inputs

Ask for these only if they aren't already provided:

  • ISMS scope — the products, locations, and information assets in scope (and what's deliberately out).
  • Context & interested parties — the business, its regulatory/customer security obligations, and key risks.
  • Risk approach — how you identify, assess, and treat information-security risk (the SoA flows from the risk assessment, not the other way round).
  • Current controls — what's already implemented across the Annex A domains.

Output Format

ISO 27001 ISMS: [organisation]

1. Scope statement — the boundary of the ISMS: assets, locations, exclusions and why.

2. Context & risk — interested parties and their requirements; the risk assessment method and risk acceptance criteria.

3. Statement of Applicability (SoA) — the heart of it: each Annex A control, applicable or not, status, and justification:

Annex A controlApplicable?StatusJustification
A.5 Access control policyYesmetRequired for customer data
A.8 TeleworkingNon/aNo remote-access to in-scope systems — excluded with rationale

(Excluding a control is fine — excluding it without a justification is an audit finding.)

4. Risk treatment plan — the top risks, the treatment (mitigate/accept/transfer/avoid), and the controls that address each.

5. Implementation roadmap — prioritised: mandatory clauses 4–10 (management system) first, then the highest-risk Annex A gaps, with owners and dates.

Programmatic Helper

scripts/soa_coverage.py (stdlib only) scores SoA coverage and flags controls excluded without a justification (the classic finding):

bash
# soa.json: [{"control":"A.5.1","applicable":true,"status":"met|partial|gap","justification":"..."}, ...]
python3 scripts/soa_coverage.py soa.json
python3 scripts/soa_coverage.py soa.json --json
Show full SKILL.md (172 more words)Show less

Quality Checks

  • The ISMS scope is explicit, including deliberate exclusions
  • The SoA covers every Annex A control with an applicable/excluded decision
  • Every excluded control carries a justification (the most common audit finding)
  • The SoA traces to the risk assessment — controls exist to treat identified risks, not for show
  • Mandatory management-system clauses (4–10) are addressed, not just the Annex A controls

Anti-Patterns

  • Do not exclude a control without a written justification — silent exclusions are audit findings
  • Do not build the SoA before the risk assessment — applicability is derived from risk, not guessed
  • Do not treat Annex A as the whole standard — clauses 4–10 (the management system) are mandatory and where many fail
  • Do not mark controls "implemented" without evidence of operation — certification audits sample evidence
  • Do not present this as certification — only an accredited body certifies; this prepares the ISMS

Based On

ISO/IEC 27001 (ISMS clauses 4–10) and Annex A control set + the Statement of Applicability requirement.

Example Trigger Phrases

  • "Scope an ISMS."
  • "Build a Statement of Applicability."
  • "Prepare for ISO 27001 certification."

© mohitagw15856, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file (scripts) in skills/iso-27001-isms of mohitagw15856/pm-claude-skills.

  • SKILL.md
  • scripts/soa_coverage.py

Open the folder on GitHubat commit 1cbf1f0

Compare with similar skills

Iso 27001 Isms next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Iso 27001 Isms compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Iso 27001 Isms this skillmohitagw15856/pm-claude-skills1.4k—~996Automated safety check: PassMIT
Nist 800 53Sushegaad/Claude-Skills-Governance-Risk-and-Compliance9461 repos~3.3kAutomated safety check: PassMIT
Soc2Sushegaad/Claude-Skills-Governance-Risk-and-Compliance9461 repos~2.7kAutomated safety check: PassMIT
Grc Knowledgemlunato47/claude-grc-plugin184—~6.1kAutomated safety check: PassMIT
Information Security Manager Iso27001davila7/claude-code-templates33k1 repos~2.9kAutomated safety check: PassMIT
Audit Frameworkscartography-cncf/cartography4.1k—~2.8kAutomated safety check: PassApache-2.0

Similar skills

  • Nist 800 53

    Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

    NIST SP 800-53 Rev 5 compliance advisor — all 20 control families (AC, AT, AU, CA, CM, CP, IA, IR, MA, MP, PE, PL, PM, PS, PT, RA, SA, SC, SI, SR), Low/Moderate/High baseline selection, FIPS 199/200…

    946 GitHub starsUsed in 1 repo~3.3k tokens
    Legal & ComplianceAuto-check passed
  • Soc2

    Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

    Expert SOC 2 compliance assistant covering all five Trust Services Criteria (Security/CC, Availability/A, Confidentiality/C, Processing Integrity/PI, Privacy/P).

    946 GitHub starsUsed in 1 repo~2.7k tokens
    Legal & ComplianceAuto-check passed
  • Grc Knowledge

    mlunato47/claude-grc-plugin

    Senior GRC analyst expertise across 18 compliance frameworks — NIST 800-53, FedRAMP (Rev5 + 20x/CR26, KSIs, VDR/VER, Certification Classes A–D), DoD/DoW Impact Levels (IL2–IL6, DISA Cloud SRG), ITAR…

    184 GitHub stars~6.1k tokensUpdated 4 days ago
    Legal & ComplianceAuto-check passed
  • Information Security Manager Iso27001

    davila7/claude-code-templates

    Senior Information Security Manager specializing in ISO 27001 and ISO 27002 implementation for HealthTech and MedTech companies.

    33k GitHub starsUsed in 1 repo~2.9k tokens
    Legal & ComplianceAuto-check passed
  • Audit Frameworks

    cartography-cncf/cartography

    Audit Cartography's rules and compliance frameworks under cartography/rules/data/rules/.

    4.1k GitHub stars~2.8k tokensUpdated today
    Legal & ComplianceAuto-check passed
  • Trust Center Builder

    GRCEngClub/claude-grc-engineering

    Builds and deploys a serverless trust center that publishes a company's compliance posture, with gated access to audit reports and an admin dashboard.

    419 GitHub stars~2.6k tokensUpdated 7 days ago
    Legal & ComplianceAuto-check passed

More from mohitagw15856/pm-claude-skills

All 1,348 skills in this repo
  • Car Tco

    mohitagw15856/pm-claude-skills

    Compare the total cost of car ownership across buy-new, buy-used, lease, and keep-your-current-car — depreciation, insurance, maintenance ramp, and fuel over a real horizon, not just the monthly…

    1.4k GitHub stars~1.1k tokensUpdated 2 days ago
    Auto-check passed
  • Cs Health Scorecard

    mohitagw15856/pm-claude-skills

    Build a customer health scorecard for a specific account. An agent skill from mohitagw15856/pm-claude-skills.

    1.4k GitHub stars~2.4k tokensUpdated 2 days ago
    Auto-check passed
  • Exit Waterfall

    mohitagw15856/pm-claude-skills

    Compute who gets what at each exit price from a cap table — liquidation preferences, conversion points, and where the founders' share collapses.

    1.4k GitHub stars~1.1k tokensUpdated 2 days ago
    Auto-check passed
  • Feature Prioritisation

    mohitagw15856/pm-claude-skills

    Apply prioritisation frameworks (RICE, MoSCoW, Kano, ICE, Opportunity Scoring) to rank features and backlog items.

    1.4k GitHub stars~2k tokensUpdated 2 days ago
    Auto-check passed
  • Fire Number

    mohitagw15856/pm-claude-skills

    Compute a financial-independence (FIRE) target and years-to-reach with every assumption labeled as an assumption — plus a sensitivity table instead of a single false-precision answer.

    1.4k GitHub stars~1.1k tokensUpdated 2 days ago
    Auto-check passed
  • Freelance Rate

    mohitagw15856/pm-claude-skills

    Derive a freelance day/hourly rate backwards from target income, honest billable utilization, overhead, and the self-employment tax premium — the arithmetic that proves a rate is not salary÷2000.

    1.4k GitHub stars~1.2k tokensUpdated 2 days ago
    Auto-check passed

Questions about Iso 27001 Isms

What does Iso 27001 Isms do?

Scope an ISO 27001 ISMS and build the Statement of Applicability across Annex A controls. Iso 27001 Isms is an agent skill from mohitagw15856/pm-claude-skills. Scope an ISO 27001 ISMS and build the Statement of Applicability across Annex A controls.

When should I use Iso 27001 Isms?

Iso 27001 Isms fits situations like: asked to implement ISO 27001; build a Statement of Applicability (SoA); prepare for ISO 27001 certification.

How do I install Iso 27001 Isms in Claude Code?

Run `npx skills add mohitagw15856/pm-claude-skills --skill iso-27001-isms -a claude-code`. Or copy the skill folder (skills/iso-27001-isms in mohitagw15856/pm-claude-skills) into .claude/skills/iso-27001-isms in your project. Claude Code loads it when a task matches its description.

How do I install Iso 27001 Isms in Codex?

Run `npx skills add mohitagw15856/pm-claude-skills --skill iso-27001-isms -a codex`. Or copy the skill folder (skills/iso-27001-isms in mohitagw15856/pm-claude-skills) into .agents/skills/iso-27001-isms in your project. Codex loads it when a task matches its description.

Can I use Iso 27001 Isms in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mohitagw15856/pm-claude-skills --skill iso-27001-isms -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/iso-27001-isms, .gemini/skills/iso-27001-isms, .github/skills/iso-27001-isms and .opencode/skills/iso-27001-isms in your project.

What does Iso 27001 Isms need to run?

Going by SKILL.md and its folder, Iso 27001 Isms needs Python for the scripts in its folder and the command-line tools its instructions call (python3). Our summary lists: Python 3.

Does Iso 27001 Isms access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Iso 27001 Isms safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Iso 27001 Isms use?

Iso 27001 Isms is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Iso 27001 Isms use?

About 996 tokens (SKILL.md is roughly 4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Iso 27001 Isms?

Skills that share tags, products or a category with Iso 27001 Isms: Nist 800 53 (Sushegaad/Claude-Skills-Governance-Risk-and-Compliance, 946 stars), Soc2 (Sushegaad/Claude-Skills-Governance-Risk-and-Compliance, 946 stars), Grc Knowledge (mlunato47/claude-grc-plugin, 184 stars) and Information Security Manager Iso27001 (davila7/claude-code-templates, 33k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Iso 27001 Isms?

mohitagw15856 (a GitHub user) maintains it in mohitagw15856/pm-claude-skills, which has 1,434 GitHub stars. The repository holds 1,348 skills in this directory. The repository was last updated on October 9, 2026.

Source: mohitagw15856/pm-claude-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.